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Abstract 

Restrictions  on  nations  military  budgets  require 
that  Air  Forces  will  operate  high  sophisticated  weapon 
systems  such  as  military  aircraft  far  beyond  their 
original  designed  life.  Modernization,  life  extension 
and  aging  aircraft  programs  are  defined  to  ensure  that 
future  mission  requirements  can  be  fulfilled  and  the 
airworthiness  of  the  aircraft  is  maintained  until  the  out 
of  service  date. 

Whilst  the  operational  life  is  increasing,  various 
aging  effects  take  place  and  impair  the  structural  and 
functional  integrity  of  high  aged  aircraft  subsystems 
even  before  their  design  life  are  reached.  An  integrated 
process  was  defined  between  customer  and  industry 
with  the  aim  of  extending  the  operational  life  of  the 
aircraft  under  limited  budgetary  conditions  and  tight 
timescales. 

Under  the  scope  of  this  task,  aging  of  equipment 
and  components,  the  impact  of  aging  problems  on 
structural  and  functional  integrity,  the  impact  of 
customer  extended  operational  requirements  on 
equipment  limitations  and  the  consequences  of  age 
related  failures  on  flight  safety  have  been  assessed. 

Recommendations  for  revised  maintenance  and 
inspection  programs  and  revised  limitations  have  been 
or  will  be  worked  out  by  industry  for  safety  and  non- 
safety relevant  equipment  to  enable  formal  certification 
of  the  aircraft  for  the  extended  period. 

This  work  is  generally  accompanied  by 
equipment  design  review,  review  of  the  in-service 
usage,  investigation  of  reported  in-service  problems 
and  related  statistics,  master  inspections  of  subsystems 
in  high  aged  aircraft  and  investigation  of  aged  loan 
equipment,  provided  by  the  Air  Forces.  Additionally, 
programs  are  conducted  to  establish  revised  in-service 
operational  conditions. 

Various  programs  have  been  defined  by  the  FAA 
and  US  Air  Force,  which  aim  on  addressing  safety 
issues  in  aging  aircraft  structural  and  non-structural 
systems. 

For  the  20  years  old  Tornado  aircraft,  a life 
extension  program  for  structure,  subsystems  and  engine 
is  presently  being  carried  out,  whose  results  should 
enable  certification  of  the  aircraft  for  the  extended 


operational  phase  and  support  safe  operation  of  the 
aircraft  for  the  next  25  years  which  means  a life 
extension  by  roughly  one  aircraft  life. 

This  paper  discusses  the  various  aspects  related  to 
aging  of  subsystems  and  the  content  and  philosophy  of 
the  Tornado  equipment  life  extension  program. 
Furthermore  specific  problems  identified  in  various 
subsystems  are  presented  together  with  a description  of 
the  way  ahead  for  life  extension. 

Overview 

This  lecture  comprises  of  four  major  parts: 

Part  1:  Introduction  and  a general  review  of  the  aging 
system  problematic  and  other  problem  areas 
related  to  an  aged  aircraft 

Part  2:  A description  of  the  subsystem  life  extension 
program  for  the  Tornado  IDS  variant 

Part  3:  Subsystem  Life  extension  approach  and 
experiences 

Part  4:  Conclusion 

Part  1 

Review  of  the  aging  system 
problematic  and  other  areas  of 
concern 

Introduction 

When  aircraft  are  getting  older  operators  are 
increasingly  confronted  with  problems,  which  are 
caused  by  the  aging  process  to  which  the  aircraft  are 
exposed.  Aging  could  degrade  the  integrity  of 
structures,  equipment  and  other  components  to  such  an 
extend  that  the  consequences  of  failures  could  be 
catastrophic. 

In  the  civil  aviation  very  spectacular  accidents 
occurred  where  aging  was  or  probably  was  the 
dominating  factor  through  which  the  accident  was 
caused: 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “Aging  Engines.  Avionics,  Subsystems  and  Helicopters’’ , 
held  in  Atlantic  City,  USA.  23-24  October  2000 ; Madrid,  Spain,  26-27  October  2000,  and  published  in  RTO  EN-14. 


6-2 


the  Aloha  Airlines  737  accident  where  due  to 
hidden  corrosion  in  the  lap  splices  the  aircraft  lost 
a big  portion  of  the  upper  front  fuselage  during 
flight 

the  TWA  Flight  800  in  July  1996,  where  the 
explosion  of  the  center  fuel  tank  might  be  caused 
by  wiring  problems. 

Both  accidents  revealed  that 

existing  maintenance  procedures  are  not 

adequately  addressing  aging  problems  in  areas, 
which  are  inaccessible  for  visual  inspections 

the  effects  of  aging  on  structural  and  functional 
integrity  of  aircraft  subsystem  components  and 
flight  safety  could  be  catastrophic 

To  operate  flight  systems  safely  within  their 
certified  life,  maintenance  procedures  have  been 
defined  taking  into  account  their  fail-safe  design 
philosophy.  This  means  that  any  failure  within  the 
subsystem,  which  could  lead  to  a safety  critical  hazard, 
would  be  extremely  improbable  and  fly  to  failure  is  the 
prevailing  philosophy.  This  is  a major  reason  why  the 
On-condition  Maintenance  Concept  (OCM)  is  applied 
to  the  majority  of  subsystem  components. 

As  aircraft  age,  the  number  of  failures  due  to 
aging  in  functional  equipment  or  other  system 
components  increases.  Aircraft  availability  and  mission 
success  will  be  increasingly  impaired  due  to 
unscheduled  maintenance  actions  required. 

Under  the  view  of  declining  budgets  and  the 
necessity  to  operate  aircraft  beyond  their  design  life 
investigations  are  performed  in  order  to  review  the 
aging  process  of  subsystem  components  in  aging 
aircraft. 

But  it  is  important  to  recognize,  that  the  aging 
process  of  any  component  cannot  be  prevented  but  the 
velocity  of  aging  can  significantly  be  reduced  by  e.g. 

identifying  critical  areas  and  components  where 
aging  could  have  serious  consequences 

reviewing  the  current  aging  process  of  subsystem 
components  in  high  aged  aircraft  or  of  high  aged 
components 

reviewing  the  current  maintenance  procedures  and 
policy  regarding  the  aging  problematic 

improving  preventive  maintenance  actions  in  order 
to  address  aging  in  an  early  stage. 

Fig.  1 presents  the  current  age  of  the  Tornado 
IDS  fleet.  It  indicates  that  the  oldest  Tornado  aircraft 
have  already  reached  a service  life  of  20  years. 

Considering  a further  planned  usage  beyond  the 
year  2020  for  the  IDS  variant,  some  IDS  aircraft  will 
stay  in  service  for  nearly  50  years. 


Fig.  1:  Age  of  the  Tornado  IDS  fleet 

This,  however,  does  not  mean  that  the 
equipments  and  components  of  subsystems  will  remain 
in  service  such  a long  time:  it  is  very  probable  that 
many  equipment  and  components  of  systems  have 
usually  already  been  replaced  during  regular  or 
unscheduled  maintenance  by  overhauled,  repaired  or 
new  items.  A uniform  in-service  life  for  all  subsystem 
components  in  an  aged  aircraft  does  not  exist. 

It  is  therefore  important  for  critical  equipment  to 
record  in-service  operational  and  maintenance  data  in 
order  to  be  able  to  assess  the  usage  history  and  life 
consumption  and  define  the  point  of  retirement  or 
where  maintenance  actions  or  overhaul  is  required  to 
ensure  safe  operation.. 

Certification  rules  require  replacement  of 
equipment  when  its  certified  life  is  reached.  As  system 
components  have  often  a life  potential  which  is  bigger 
than  the  certified  life  and  in  order  to  get  the  maximum 
benefit  of  equipment  in  terms  of  performance  and 
costs,  an  subsystem  life  extension  program  is  carried 
out. 

Within  this  life  extension  process,  which  will  be 
described  in  a later  chapter,  aging  problems  within 
each  subsystem  have  been  investigated  and  taken  into 
account  for  defining  appropriate  measures  for  life 
extension. 

The  following  chapter  discusses  briefly  which 
effects  are  generally  contributing  to  aging  of  subsystem 
components. 

Aging  mechanisms 

Aging  is  understood  as  a process,  where  the 
structural  and/or  functional  integrity  of  equipment  / 
components  will  be  continuously  degraded  by  the 
exposure  to  environmental  conditions,  under  which  the 
equipment  is  operated. 

This  could  lead  in  the  worst  case  to  a situation 
where  the  aged  equipment  / component  cannot  fulfill 
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any  more  its  designed  function,  even  before  the  design 
life  of  the  item  is  reached.  In  this  case,  subsystem 
functions,  which  the  item  has  fulfilled  or  supported, 
could  be  lost  or  degraded,  which  may  also  affect  flight 
safety. 

There  are  various  mechanisms,  which  alone  or  in 
combination  are  responsible  for  equipment  aging. 

Exposure  to  normal  or  salty  atmosphere,  heat, 
water,  oil,  grease,  fuel,  ultraviolet  light,  etc.,  which 
could  lead  to  corrosion,  embrittlement,  swelling, 
overheating,  melting  or  other  material  degradation, 
electrical  interruptions,  short  circuits,  etc. 

Exposure  to  vibration  and  acoustic  environment, 
which  could  lead  to  fatigue  damages,  wear  and 
tear,  etc. 

Endurance,  which  could  lead  to  leakage,  wear  and 
tear,  etc. 

Storage,  which  means  exposure  to  storage 
conditions,  specified  by  the  equipment  supplier  or 
in-service  practice 

Maintenance  activities,  which  can  induce 
accidental  damages  (which  could  be  a particular 
problem  for  wiring) 

It  is  likely  that  reliability  and  availability  of 
equipment  will  be  impaired  by  these  mechanisms. 

Additionally,  incorrect  installation  of  equipment 
could  also  have  a detrimental  effect  and  support  the 
aging  process,  e.g.  enable  chafing  of  wire  bundles  on 
surrounding  structure  (this  can  be  the  result  of  poor 
design  but  also  of  poor  maintenance). 

Aged  equipment  and  components  will  be  removed 
from  service  if  further  use  is  not  recommended  for 
safety  reasons  or  if  further  safe  operation  is 
uneconomical  due  to  required  inspection  and 
maintenance  activities. 

Life  expired  equipment  can  be  defined  by  the  fact 
that  any  in  (equipment)  specification  specified  and 
certified  life  limitations  are  reached  by  the  in-service 
usage  and  therefore  need  to  be  replaced. 

Life  extension  might  be  possible  and  needs  to  be 
investigated.  In  case,  the  design  and  certification 
authority  permit  further  on  aircraft  operation  under 
clearly  defined  conditions,  further  use  of  the  equipment 
can  be  tolerated  without  formal  re-qualification  and  for 
a limited  time:  as  the  aircraft  runs  out  of  certification 
(>4000  FH)  and  the  formal  certification  process  up  to 
8000  FH  has  not  been  completed  yet,  the  definition  of 
such  conditions  and  requirements  for  further  usage  up 
to  5000  FH  is  part  of  the  Tornado  life  extension 
program. 


Influence  of  maintenance  on  aging 

As  already  mentioned,  aging  of  equipment  and 
components  cannot  be  prevented  but  slowed  down.  It  is 
reasonable  to  say  that  if  maintenance  is  poorly  or  not 
timely  conducted  certain  aging  effects  (e.g.  wear  and 
tear,  contamination,  corrosion,  etc.)  could  be 
accelerated  or  even  started. 

This  means  that  the  physical  condition  of  aged 
equipment  and  components  in  different  aircraft  can 
vary  due  to  different  quality  of  maintenance  carried  out 
which  could  result  in  earlier  retirement  of  components 
than  assigned. 

Aircraft  maintenance  programs  will  always  be  a 
compromise  as  beside  others  logistic  costs  and  overall 
fleet  management  are  important  issues,  which  drive 
their  definition. 

The  Tornado  is  operated  by  three  different  air 
forces,  which  have  different  maintenance  programs  and 
procedures.  The  major  depot  inspection  for  the  RAF 
and  GAF  is  currently  at  2400  FH  (or  14  years,  RAF 
only)  and  2000  FH  for  the  IAF.  Considering  the  fact 
that  at  the  beginning  of  the  Tornado  program  the  DI 
was  at  1600  FH,  the  time  where  a thorough 
investigation  of  the  aircraft  condition  is  performed  has 
significantly  increased  (by  50%). 

In  view  of  this  and  to  address  aging  problems,  it 
is  important  to  include  preventive  maintenance  actions 
for  critical  equipment  and  areas,  at  shorter  intervals  in 
periodic  servicing  schedules  or  in  special  inspections, 
to  ensure  that  aging  problems  will  be  detected  in  an 
early  state  where  the  effort  for  repair  is  still  acceptable 
and  an  airworthiness  critical  situation  far  away. 

Within  the  Tornado  subsystem  life  extension 
program  aging  effects  on  equipment  and  components 
are  investigated  as  far  as  they  are  obvious  and  known. 
The  results  of  these  investigations  will  be  used  by  the 
manufacturers  to  establish  revised  maintenance 
procedures  for  their  equipment  where  necessary. 

Other  problems  areas 

Besides  the  aging  problematic,  other  topics  which 
are  not  related  to  aging  but  causes  problems  in  an  aged 
aircraft  need  to  be  considered  and  investigated.  The  list 
might  not  be  complete  but  describe  the  major  problem 
areas. 

Operational  conditions 

These  might  have  changed  during  the 
lifetime  of  the  aircraft. 

For  an  aged  aircraft  where  life  extension  is 
an  issue  the  current  and  future  planned  operational 
conditions  need  to  be  investigated  and  compared  to 
the  original  design  requirements,  This  can  be  done 
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by  engineering  assessments  or  if  the  conditions 
cannot  be  established  on  an  theoretical  basis  by 
Operational  Load  Measurement  (OLM)  programs. 

The  outcome  of  such  programs  will  be  used 
to  calculate  existing  clearances  and  life  potential  or 
provide  a basis  for  further  qualification  testing. 

The  establishment  and  conduction  of  OLM 
programs  are  often  very  costly  and  time 
consuming.  Therefore,  any  decision  for  such 
programs  should  be  taken  early  enough  to  ensure 
that  results  are  available  in  time. 

In  the  Tornado  program  such  Operational 
Load  Measurements  (OLM)  are  conducted  in  the 
Landing  Gear  System  as  presented  later. 

Usage  history,  life  consumption 

As  required  by  formal  certification  rules, 
equipment,  which  exceeds  stated  life  limits  are 
formally  out  of  certification.  Therefore,  the  usage 
history  needs  to  be  established  and  this  requires 
the  availability  of  complete  in-service 

documentation  (LOG  cards,  maintenance 

documentation). 

Unfortunately,  it  has  been  experienced  that  it 
is  sometimes  very  difficult  to  get  all  the 
information  necessary  to  assess  service  life  and  life 
consumption.  For  safety  relevant  and  life  limited 
components  this  causes  many  problems  as  it  might 
be  not  possible  in  these  cases  to  establish  whether 
an  equipment  is  already  life  expired  or  not. 

Repairs  and  concessions 

The  influence  of  repairs  and  concessions  on 
life  limitations  needs  to  be  assessed. 

Normally,  minor  concessions  should  not 
affect  life  limits,  but  if  the  operational  conditions 
have  changed  in  the  past,  the  classification  of 
concessions  needs  to  be  reassessed. 

Obsolescence 

Obsolescence  is  a problem,  which  becomes 
more  problematic  with  increasing  age  of  the 
aircraft. 

Materials  and  components,  which  have  been 
used  in  the  original  design,  could  be  no  more 
available  and  this  could  require  redesign  and  re- 
qualification  activities  if  no  proofed  and  certified 
alternatives  exist. 

Especially  for  electronic  parts  obsolescence 
is  a critical  and  costly  issue  as  technology  progress 
over  the  last  20  years  was  so  enormous  that  certain 
items  remain  only  available  in  a limited  quantity. 
A strategy  for  future  support  of  electronic 
equipment  needs  to  be  established. 


Availability  of  original  supplier 

For  most  of  the  major  equipment  there  was 
only  one  supplier  selected,  who  has  designed  and 
qualified  the  item.  This  supplier  might  have 
disappeared  or  no  more  able  to  produce  the 
required  component.  Introduction  of  alternative 
supplier  will  cause  problems  in  terms  of  time  and 
costs.  Dependency  on  one  supplier  is  critical  but 
usual. 


Costs  for  procurement  of  equipment 

The  procurement  of  equipment  for  replacing 
aged  or  life  expired  equipment  after  20  years  in 
service  could  be  very  costly  as  e.g.  original 
supplier  are  no  more  existent,  design  and 
qualification  of  new  components  are  necessary  or 
the  required  number  of  equipment  is  very  small. 

Inspections  and  inspection  efficiency 

With  the  aging  of  the  aircraft  aging  effects 
will  increasingly  require  inspections  of  critical 
equipment  and  components  to  ensure  that  any 
aging  effect  will  not  lead  into  a safety  hazardous 
situation.  The  success  of  inspections  is  very 
dependent  on  the  selection  of  the  appropriate 
methods,  availability  of  required  equipment, 
clearly  defined  inspection  procedures,  availability 
of  trained  personal. 

Maintenance  documentation 

Existing  maintenance  procedures,  which  do 
not  address  aging  as  experienced  by  investigations 
or  sampling,  needs  to  be  revised.  Requirements  or 
recommendations  of  the  equipment  manufacturer, 
defined  during  the  life  extension  process,  should 
be  included. 

Failure  and  maintenance  reporting  systems 

Most  aircraft  users  are  maintaining 
comprehensive  databases  to  collect  and  evaluate 
failure  and  maintenance  reports  for  the  whole 
aircraft  down  to  equipment  and  component  level  in 
order  to  identify  unreliable  equipment  and  other 
problem  areas. 

However,  in  service  data  collection  systems 
are  mainly  defined  by  the  aircraft  users  and  reflect 
their  specific  needs  and  points  of  interest.  The 
definition  of  data  elements  and  the  level  of  detail 
may  significantly  vary,  even  between  the  different 
users  of  the  same  aircraft  type. 

For  this  reason,  the  probability,  that  failure 
and  maintenance  data  collected  during  service  are 
compatible  with  design  analysis  and  predictions  is 
fairly  low. 
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Moreover,  in  service  data  are  not  always 
available  to  the  system  design  authority  at  a level 
required  e.g.  for  equipment  aging  investigations. 

The  value  of  an  in  service  database  can  only 
be  as  good  as  the  entries.  It  is  therefore  important 
to  consider  that  any  analysis  or  curves  derived 
from  databases  need  specific  interpretation  and 
should  be  taken  with  care. 

The  major  “lessons  learnt”  for  future  data 
collection  systems  are  therefore  continuous 
availability  to  both  user  and  manufacturer  and  the 
need  for  compatibility  with  design  analyses,  in 
order  to  gain  maximum  benefit  over  the  aircraft 
lifetime. 

Similar  problems  are  mentioned  in  other 
publications.  It  is  therefore  important  to  consider 
that  any  analysis  or  curves  derived  from  databases 
should  be  taken  with  care. 

Aging  of  Tornado  subsystems 

To  get  an  overview  on  the  magnitude  of 
subsystem  aging  problems,  the  increase  of  aging 
related  failure  rates  have  been  investigated.  Fig.  2. 


Fig.  2:  Reported  in-service  failures  due  to  aging 

For  these  trend  curves  failures  are  considered 
which  could  be  attributed  to  aging,  such  as  corrosion, 
wear  and  tear,  leakage,  contamination,  porosity, 
brittleness,  contact  damage,  isolation  damage,  etc. 

However,  it  should  be  noted  that  these  curves  are 
only  trend  curves  as  it  is  very  difficult  to  analyze 
whether  the  reported  failures  are  really  due  to  aging  or 
other  influences. 

The  analysis  has  been  performed  for  the 
following  subsystems  and  for  the  period  1990  until 
1999: 

Landing  Gear  subsystem 


Flight  Control  subsystem 
Electric  Subsystem 
ECS  Subsystem 
Fuel  Subsystem 
Hydraulic  Subsystem 

The  investigation  show  an  significant  increase  of 
aging  related  failures  over  the  last  decade  for  the 

Hydraulic  Subsystem  by  1 60% 

Fuel  Subsystem  by  120% 

Landing  Gear,  Flight  Control  and  ECS  subsystem 
by  50% 

Electric  Subsystem  by  15%. 

The  biggest  contribution  to  the  above  curves  in 
the  Hydraulic  and  Fuel  System  is  leakage  with  43%, 
respectively  19%. 

After  the  description  of  general  aspects  of  the 
aging  problematic  and  additional  problem  areas,  we 
have  encountered  in  the  Tornado  program,  part  2 will 
describe  the  Tornado  Subsystem  Life  Extension 
program  for  the  Tornado  IDS  variant,  as  it  is  presently 
being  carried  out. 

Part  2 

Tornado  subsystem  life  extension 
program 

As  introduction  a very  brief  survey  of  the 
Tornado  program  should  be  given,  before  describing  in 
detail  the  philosophy  and  process  of  the  Tornado 
Subsystem  Life  Extension  program. 


Tornado  Program 


The  Tornado  aircraft  was  designed  and  developed 
in  three  European  countries,  the  United  Kingdom 
(42,5%  share),  Germany  (42,5%)  and  Italy  (15%) 
according  a set  of  tri-national  agreed  Performance  and 
Design  Requirements  (PDR)  which  form  a compromise 
between  national  requirements. 
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The  major  aerospace  companies  in  these  three 
countries  were  in  charge  to  build  this  aircraft,  which 
have  been  British  Aerospace,  BAe,  (now  BAE 
SYSTEMS),  Messerschmitt-Bolkow-Blohm,  MBB, 
(now  DaimlerChrysler  Aerospace,  DASA)  and 
Aeritalia  (now  Alenia). 

The  PANAVIA  Aircraft  GmbH  was  formed  by 
these  three  companies  (PANAVIA  Partner  Companies, 
PPCs)  in  order  to  manage  the  program  on  industry  side. 

On  the  customer  side,  the  program  is  controlled 
by  NAMMO,  the  NATO  MRCA  Development  and 
Production  Management  Organization,  and  today 
managed  by  the  NATO  European  EF2000  and  Tornado 
Agency,  NETMA  (former  NAMMA).  NAMMO  and 
NETMA  are  staffed  by  specialists  from  all  three 
Nations. 

The  first  flight  of  Tornado  was  successfully 
performed  in  1974  and  the  first  production  aircraft  was 
completed  in  1980. 

In  total  977  aircraft  have  been  built  in  two  major 
variants,  that  are  the 

Interdiction  Strike/ Attack  (IDS)  variant,  which  is 
operated  by  all  three  Nations  Air  Forces  (RAF: 
228  aircraft,  GAF:  357,  IAF:  99)  and  also  the 
Royal  Saudi  Air  Force  (RSAF)  (96) 

and  the 

Air  Defense  Version  (ADV),  which  is  operated  by 
the  RAF  (173)  and  the  RSAF  (24).  Today  also  the 
IAF  operate  ADV  aircraft,  leased  from  the  RAF. 

Single  stick  and  trainer  versions  exist  for  both 
variants.  Additional,  for  the  IDS  various  sub-variants, 
e.g.  the  Electronic  Combat  Reconnaissance  (ECR) 
variant,  exist,  differently  equipped  to  perform  specific 
missions  and  to  carry  specific  external  stores. 

The  development  and  production  of  Tornado  was 
shared  between  the  three  Nations  roughly  according  the 
intended  number  of  aircraft  they  wished  to  procure. 

The  responsibilities  for  design  and  production  of 
the  airframe  were  shared  between  BAE  SYSTEMS 
(front  and  rear  fuselage),  DASA  (center  fuselage)  and 
Alenia  (wing). 

For  the  development  and  qualification  of 
subsystems,  System  Design  Responsibilities  (SDR)  for 
each  system  and  Equipment  Design  Responsiblies 
(EDR)  were  defined.  SDRs  and  EDRs  were  shared 
between  BAE  SYSTEMS  and  DASA  but  they  were  not 
necessarily  in  one  hand. 

As  there  are  some  differences  in  subsystem 
design  between  IDS  and  ADV,  a separate  life  extension 
task  has  been  defined  for  the  ADV  variant.  This  task 
deals  with  the  life  extension  of  ADV  specific 
equipment  and  equipment,  which  is  common  to  IDS 
but  differentially  loaded  in  service  and  therefore 
different  life  limitations  needs  to  be  established. 


Common  items  to  IDS  with  same  operational  loading 
conditions  are  covered  by  the  IDS  life  extension 
process. 

In  this  lecture,  only  the  IDS  life  extension  process 
will  be  described  where  the  fundamentals  of  this 
process  have  been  discussed  and  defined. 

Tornado  IDS  Subsystem  Life  Extension 
Process 

The  subsystem  life  extension  program  is  integral 
part  of  the  aircraft  life  extension  program,  which 
includes  also  engines  and  structures.  Aircraft 
certification  will  be  a compilation  of  the  output  of  all 
three  separate  tasks. 

Nations  requirements  for  the  extended  use  of 
Tornado  IDS  are  shown  in  Fig.  3. 

The  basic  tri-national  requirement  for  life 
extension  was  that  PANAVIA  should  establish  the 
basis  for  aircraft  certification  up  to  8000  FH,  based  on 
the  original  PDR  requirements. 

Additional  to  that,  UK  wish  to  extend  the  life  of 
their  IDS  for  a further  2000  FH  up  to  10000  FH. 


Current  and  future  Nations  IDS  Life 
Requirements 


Fig.  3 : Life  extension  requirements 

The  current  planning  of  Nations  air  forces 
revealed  that  they  intend  to  operate  the  IDS  Tornado 
aircraft  beyond  the  year  2025  (GE  and  IT)  and  2020 
(UK),  which  means  that  the  oldest  aircraft  will  stay  in 
service  for  about  50  years. 

Certification  documentation  of  the  aircraft  and  its 
equipment  includes  life  limitations.  Consequently, 
operational  use  by  the  air  forces  beyond  this  limitation 
is  at  Air  Forces  own  risk  and  absolves  PANAVIA  and 
their  supplier  from  any  product  liability. 

Therefore,  Nations  via  NETMA  required  that 
PANAVIA  should  be  tasked  to  perform  work  that 
would  allow  PANAVIA  to  resume  the  product  liability 
for  the  extended  period. 
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In  1995  PANAVIA  was  contracted  to  carry  out  a 
program,  which  aims  on  extending  the  life  of 
TORNADO  IDS  and  ECR  variants  significantly 
beyond  the  current  life  limits  up  to  8000  FH,  which 
means  a doubling  of  the  aircraft  operational  life. 

The  overriding  constraint  upon  extended 
certification  is  that  no  significant  reduction  of  flight 
safety  is  acceptable,  although  equipment  reliability  in 
some  cases  may  be  degraded  with  time.  This  requires 
the  identification  and  assessment  of  equipment  and 
components  which  failure  would  be  safety  critical. 

The  certification  of  equipment  for  the  extended 
period  requires  that  the  equipment  Declaration  of 
Design  & Performance  (DDP)  will  have  to  be  updated 
stating  the  new  life  limits  as  outcome  from  the  life 
extension  process. 

The  approach  of  identifying  equipment,  which 
should  be  regarded  for  life  extension  activities, 
considers  that  aircraft  subsystems  are  generally 
designed  to  fail  safe  design  principles  and  thus 
comprise  of  equipment  and  components  which  can  fail 
to  perform  their  function  without  presenting  or 
significantly  contributing  to  a hazardous  situation. 

The  philosophy  of  this  approach  was  agreed  with 
NETMA  and  PANAVIA  was  tasked  to  focus  on  safety 
relevant  items  which  definition  for  the  purpose  of  this 
task  has  been  defined  as  follows: 

Components  are  considered  to  be  safety 
relevant,  where  a single  failure  would  cause  a 
hazard  or  which  in  combination  with  other 
failures  would  significantly  contribute  to  a 
hazardous  situation. 

A hazardous  situation  occurs  when  conditions  arise 
which  threaten  the  safety  of  the  crew,  aircraft, 
ground  crew  or  third  parties. 

For  this  life  extension  task  the  term  safety 
relevant  covers  both  “Flight  Safety  Critical”  and 
“Flight  Safety  Involved”  incidents. 

The  following  list  states  the  Tornado  flight 
systems,  which  are  subject  of  life  extension  activities: 

Crew  System 

Electric  System 

Environment  Control  System 

Fire  Detection  & Suppression  System 

Flight  Instruments 

Flight  Guidance  & Control  System 

Flight  Control  System 

Fuel  System 

Hydraulic  System 

Landing  Gear  System 

Pitot  Static  System 


Propulsion  System 
Secondary  Power  System 
Weapon  delivery  system 
UK  Armament  Control  System 

The  assessment  of  the  safety  relevance  of 
equipment  attachment  structures  was  also  part  of  the 
task.  Each  EDR  performed  the  assessment  of 
attachment  structures  for  his  area  of  responsibility  and 
defined  in  conjunction  with  the  relevant  structure  SDR 
appropriate  measures  for  life  extension,  if  necessary. 

For  financing  and  managing  purposes,  the  whole 
life  extension  task  was  structured  into  4 different 
phases,  in  which  the  level  of  involvement  of  the 
customer,  PANAVIA  and  the  PPCs  and  the  supplier 
varies  significantly. 

Phase  A:  Identification  of  Safety  Relevant  Equipment 
and  Attachment  structures 

Phase  B:  Nations  review  of  Phase  A recommendations 
and  selection  of  items  which  should  be 
subject  of  further  life  extension  work 

Phase  C:  Equipment  extended  certification  activities 

Phase  D:  Aircraft  extended  certification  and 

preparation  of  a new  PANAVIA  Lifed  Items 
List. 


It  is  currently  planned  to  finish  the  IDS 
subsystem  life  extension  program  at  the  end  of  2002 
including  UK  IDS  life  extension  to  10000  FH  and 
aircraft  certification  activities. 

Phase  A 

Identification  of  Safety  Relevant  Equipment 
and  Attachment  structures 

A process  flow  diagram  for  Phase  A and  B is 
given  in  the  annex. 

For  each  system,  review  of  the  existing  System 
Safety  Assessments  Reports  was  the  agreed  approach  to 
determine  the  safety  or  non-safety  relevance  of 
equipment  according  to  their  contribution  to  a 
hazardous  situation. 

As  these  reports  have  been  issued  a considerably 
time  ago  during  the  design  phase  of  Tornado,  new 
experiences  and  in-service  arisings  have  also  been 
taken  into  account  as  well  as  the  effects  of  equipment 
failure  on  surrounding  area  and  also  where  failure 
effects  cross  the  boundaries  of  different  subsystems. 

Completeness  was  ensured  by  use  of  equipment 
lists  (WUC)  and  illustrated  part  catalogues. 
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As  a result  of  the  safety  assessments  during 
Phase  A,  a Flight  System  Hazard  Analysis  Report  has 
been  produced  by  PANAVIA  covering  separately  each 
subsystem. 

For  each  safety  relevant  item  a proforma  was 
written  by  the  Equipment  Design  Responsible  (EDR), 
which  provides  informations  of  the  equipment  as  for 
instance  part  number,  DDP,  qualification  status,  life 
limitations  and  overhaul  requirements,  its  function 
within  the  subsystem,  failure  mode  and  hazard 
contribution.  The  proforma  format  ensured  consistent 
information  for  all  equipment  and  components  for  all 
subsystems.  The  overall  responsibility  of  the  content  of 
the  proforma  rests  with  the  SDR  for  each  subsystem. 

This  report  also  provide  a subsystem  equipment 
list  supporting  the  aircraft  level  certification  for  all 
items  which  are  no  more  further  considered  as  they  are 
of  negligible  or  low  risk. 

The  final  phase  A report  was  subject  of  a system 
review  meeting  attended  by  NETMA,  Nations  and 
PANAVIA  in  order  to  further  refine  the  safety 
relevance  of  equipment  into  one  of  the  subsets  of  safety 
relevance  as  described  below: 

CAT1:  Item  Safety  Relevant,  qualification  life 

limitations  are  critical  and  to  be  observed 

CAT2:  Item  Safety  Relevant  but  qualification  life 
limitations  are  unlikely  to  be  critical  and  further 
qualification  or  analysis  to  extend  life  should 
be  considered. 

CAT3:  Item  Safety  Relevant,  failure  or  malfunction  of 
the  item  has  no  significant  airworthiness 
consequences. 

The  general  guidelines  for  determination  of  the 
safety  relevance  are  presented  in  the  following  table. 


This  guideline  chart  cannot  be  regarded  as 
definitive.  It  essentially  required  system  specialist 
engineering  judgment  to  establish  the  severity  of  any 
failure  or  failure  combination  consequences. 

Additional,  the  following  criteria  have  been 
considered  in  the  categorization  refinement  review: 

Level  of  resulting  hazard 
Probability  of  occurrence 
Subsystem  design  philosophy 
Dormancy 

Prevailing  poor  reliability 

Fatigue,  endurance  or  any  other  life-limiting  factor 
Impact  on  existing  overhaul  or  maintenance 

All  components,  which  have  not  been  categorized 
in  one  of  the  above  categories,  have  been  defined  as 
Non  Safety  Relevant  (NSR). 

After  each  subsystem  review,  each  proforma 
were  reviewed  and  amended  to  include  statements 
declaring  the  agreed  safety  relevant  categorization 
together  with  the  justification  argument  or  evidence. 

It  was  agreed  at  the  end  of  this  phase  that 
equipment,  which  has  been  categorized  as  CAT3  or 
NSR,  could  be  regarded  as  suitable  for  continued 
service  in  accordance  with  an  On  Condition  lifing 
policy  (OCM),  which  means  a concept  of  maintenance 
that  is  free  from  scheduled  actions.  Maintenance  action 
is  taken  only  when  an  item  of  equipment  is  found  to  be 
defective.  Exceptions  to  OCM  are  permitted  only  when 
a scheduled  action  is  necessary  to  prevent  a safety 
hazard,  inability  to  meet  safe  life  design  criteria,  or  on 
grounds  of  economy  to  preclude  expensive  damage. 

There  are  specific  items,  which  need  special 
consideration  in  terms  of  life  extension: 


Severity  of 
hazard 

Catastrophic 

Critical 

Marginal 

(Major) 

Negligible 

Single  failure 
Safety  critical 

CAT1 

OR 

CAT2 

CATl 

OR 

CAT2 

Double  failure 
common  mode 
contribution 

CAT1 

OR 

CAT2 

CATl 

OR 

CAT2 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Double  Failure 
Dormant  Item 

CAT1 

OR 

CAT2 

CATl 

OR 

CAT2 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Double  Failure 
Significant 
contribution  / 
known  problem 

CAT1 

OR 

CAT2 

CATl 

OR 

CAT2 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Double  Failure 
Non-Dormant 
Item 

CAT3 

CAT3 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

> OR  = Triple 

Failure 

condition 

CAT3 

CAT3 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Safety  relevant 

Non  Safety  Relevant 

PANAVIA  Standard  Items 

There  is  a big  number  of  standard  parts  as 
connectors,  screws,  relays,  switches,  clamps  etc.  used 
all  over  the  aircraft  and  commonly  in  different 
subsystems. 

These  items  are  normally  not  limited  to  flying 
hours  but  are  specified  to  operations,  cycles  etc.  There 
are  also  numerous  items  for  which  no  life  limitations 
exist. 

The  general  approach  for  standard  items  is  to 
reduce  the  list  to  items  for  which  a life  limitation  was 
stated  and  which  is  not  sufficient  in  view  of  the  lifing 
requirements  of  this  task.  Additionally,  items  are 
considered  which  contain  any  degradable  or  perishable 
materials. 

For  these  items  an  assessment  on  their  safety 
relevance  in  above  terms  has  been  conducted  and  a 
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categorization  defined.  This  approach  is  shown  in 
detail  in  a flow  chart  in  the  annex. 

All  other  standard  items,  which  are  not  safety 
relevant,  are  considered  to  remain  on-condition. 

Electrical  Wiring 

Electrical  wiring  is  largely  used  in  the  aircraft.  It 
comprises  of  PANAVIA  wire  of  various  construction 
and  materials,  electrical  connectors,  loom  supporting 
devices  etc.  The  life  extension  strategy  for  wiring  is 
discussed  in  Part  3 of  this  paper. 

Attachment  structure  items 

The  system  engineers  have  reviewed  the 
criticality  of  attachment  structure  items.  It  became 
obvious  that  not  all  structure  items  need  specific 
actions  for  life  extension. 

Attachment  structure  items  are  generally 
designed  to  static  stress  conditions,  loads  resulting 
from  crash  and  maneuver  accelerations  and  stiffness 
requirements.  Additional,  the  installation  uses  good 
design  practices  related  to  bend  radii,  hole  edge 
distances  and  minimizing  tension  cleat  loading.  These 
criteria  result  in  equipment  supports,  which  are 
sufficiently  robust  for  any  normal  aircraft  lifing. 

It  is  further  considered  that  fatigue  is  not  a 
dominating  factor  for 

Large  bore  Pipes  in  the  air  and  Fuel  subsystem 
Small  bore  pipes  in  the  Hydraulic  and  Oxygen 
subsystem 

Flying  Control  Linkages 

Whilst  good  design  practices  were  used  in  order  to 
reduce  the  risk  of  failures,  in-service  maintenance 
programs  and  inspections  have  to  ensure  that  the 
integrity  of  such  components  due  to  corrosion, 
contamination,  foreign  damages  etc.  are  not  impaired. 

Attachment  structure  items,  which  fall  under  the 
above,  are  no  more  subject  to  fatigue  life  extension 
activities. 

All  other  components  and  specific  equipment 
mounting  structures  are  covered  by  the  structure  life 
extension  task. 

In  Phase  B now,  the  results  of  Phase  A activities, 
laid  down  in  the  System  Hazard  Analysis  Report 
formed  the  basis  for  the  customer  review  of  safety 
relevant  items. 


Phase  B 

Nations  review  of  Phase  A recommendations 
and  selection  of  items  which  should  be  subject 
of  further  life  extension  work 

During  this  phase  NETMA  and  Nations  reviewed 
the  recommendations  provided  by  PANAVIA  within 
the  System  Hazard  Analysis  Report  with  their  own 
specialists  and  took  decisions  on  which  safety  relevant 
component  they  wish  to  support  for  extended 
certification. 

The  following  criteria  (beside  others)  might  have 
been  used  by  the  customer  for  their  decisions: 

Premature  failures  predominant  in-service,  i.e.  the 
item  does  not  generally  achieve  its  current  design 
life 

Financial  and  economic  aspects  as  life  extension 
will  be  too  expensive  or  too  long,  low  cost  item, 
economic  of  overhaul,  obsolescence  arisings 

Modification  is  already  planned  to  replace  existing 
item 

At  the  end  of  this  phase  the  customer  stated  to 
PANAVIA  which  equipment  should  be  subject  of 
further  life  extension  activities  in  Phase  C. 

Phase  C 

Equipment  extended  certification  activities 

A process  flow  diagram  for  Phase  C and  D can  be 
found  in  the  annex. 

This  phase  consist  in  detail  of 

requesting  suppliers  proposal  for  life  extension  of 
safety  relevant  CAT2  equipment  which  have  been 
selected  with  a declared  preferred  option  for  life 
extension 

assessment  of  suppliers  proposal  and  agreement  on 
a technical  and  financial  issues 

issuing  the  proposal  to  the  customer  awaiting 
authorization  for  start  of  work 

conducting  of  life  extension  technical  work  based 

on  original  specification  requirements 

update  of  equipment  DDP  reflecting  the  latest 

qualification  status  and  finally 

update  of  the  System  Hazard  Analysis  Report  at 

conclusion  of  work  within  a specific  subsystem 


6-10 


Phase  D 

Aircraft  extended  certification  and  preparation 

of  a new  PAN  AVIA  Lifed  Items  List. 

After  completion  of  the  equipment  extended 
qualification  activities,  this  Phase  D covers  the  aircraft 
level  certification  activities. 

Also  within  this  phase,  a new  PANAVIA  Lifed 
Items  List  will  be  issued,  containing 

lifing  requirements  for  all  safety  relevant  items, 
which  have  not  achieved  full  qualification 
evidence  (with  respect  to  the  LE  lifing 
requirements) 

mandatory  overhaul  requirements  for  the  extended 
period 

Part  3 will  now  describe  in  some  detail  for 
various  subsystems  the  agreed  specific  approach  for 
life  extension  and  major  findings  and  problem  areas 
related  to  aging  experienced  during  the  life  extension 
work. 

Part  3 

Subsystem  Life  extension 
approach  and  experiences 

Life  extension  measures 

Most  of  the  Tornado  equipment  were  only 
qualified  according  the  life  requirements  stated  in 
subsystem  and  equipment  specifications  and  only  some 
equipment  have  already  been  subject  to  extended 
qualification.  For  many  equipment,  where  no 
significant  failure  at  the  end  of  their  original 
qualification  was  found,  the  final  life  is  unknown. 

The  definition  of  the  appropriate  measure  for 
equipment  life  extension  was  made  in  cooperation  with 
the  equipment  supplier  taking  into  account  all 
information  available  from  original  qualification,  in- 
service  experience  and  future  service  requirements. 

In  principle  the  following  questions  must  be 
answered: 

a)  Is  the  presently  stated  clearance  still  valid  and  is 
there  any  life  potential  for  extended  use  beyond 
4000  FH  based  on  the  existing  or  changed  service 
requirements  or  under  which  conditions  is  the 
extended  use  acceptable? 

b)  Are  there  any  limiting  factors,  as  for  instance 
aging  problems,  low  reliability,  economical 
reasons,  which  would  not  recommend  further 
usage  of  the  item? 


The  answers  on  both  items  will  define  future 
usage  requirements. 

Item  a)  will  generally  be  investigated  by 

review  of  the  original  qualification 

assessment  of  validity  of  original  specified 
operational  requirements,  e.g.  supported  by  OLM 
programs 

analysis 

conduction  of  re-qualification  programs  covering 
aspects  such  as  fatigue  and  endurance  testing 
(taking  into  account  revised  operational 
conditions,  where  agreed  with  the  customer) 

Item  b)  will  generally  be  investigated  by 

review  of  the  in-service  experience  (reported 
failures,  repair  and  overhaul  experience,  . . .) 

review  of  MTBF  data  where  available 

sampling  of  aged  equipment  from  service,  for 
which  a full  service  history  can  be  provided, 
where  the  consumed  life  can  be  established,  which 
have  not  been  overhauled  and  where  the 
operational  usage  is  representative  for  the  normal 
fleet  usage 

Master  inspections  of  complete  subsystems,  which 
take  place  on  one  or  several  different  aircraft, 
which  have  a service  life  near  to  4000  FH 

Zonal  inspections  of  critical  zones,  which  have 
been  defined  for  instance  by  the  results  of  the 
Master  Inspection  or  by  available  experience  from 
service 

Although  difficult  to  say  generally,  the  following 
table  tries  to  give  an  overview  on  the  measures  which 
are  conducted  for  a certain  type  of  equipment  / 
component,  (however  this  does  not  mean  that  all 
measures  are  conducted  in  the  same  time) 


Equipment  / 
Component 

Life  extension  measure 

Mechanical 

equipment 

Analysis,  fatigue  test,  overhaul 

Mechanical  / 

Hydraulic 

equipment 

Sampling,  overhaul,  analysis,  fatigue, 
impulse  fatigue  and  endurance  testing, 
definition  of  inspection  and  overhaul 
procedure 

Electronic 

equipment 

Sampling,  definition  of  inspection  and 
overhaul  procedure 

Pipework 

Master  and  Zonal  inspections, 
overhaul,  definition  of  maintenance 
procedure 

Equipment  / 
Component 

Life  extension  measure 

Hoses  (hydraulic 
fuel,  nitrogen) 

Sampling,  replacement  of  high 
pressure  and  nitrogen  hoses 

Standard  parts 

Review,  analysis 

Wiring 

Sampling,  Master  and  Zonal 
inspections,  definition  of  test  concepts, 
definition  of  inspection  and 
maintenance  procedure 

Attachment 

structure 

Review,  fatigue  analysis,  fatigue  test 

Following,  more  detail  informations  are  given  for 
various  subsystems: 

Landing  Gear  Subsystem 

General 

Landing  gear  systems  consist  of  very  different 
type  of  components,  as  for  instant  load  carrying 
structures,  electric  components  (switches,  relays, 
wiring  and  connectors,  circuit  breakers),  mechanical  / 
hydraulic  components  (piping,  couplings,  hoses, 
valves,  swivels,  actuators,  manifolds),  which  are 
necessary  to  provide  various  system  functions: 

Take  off,  landing  and  ground  operation  capability 
Retraction  & Lowering  and  emergency  lowering 
Steering 

Braking  and  anti-skid 
Arrested  landing  capability 

Major  system  failure  modes  are: 

Collapse  of  gears  due  to  structural  failures 

Inability  to  lower  gears  by  the  normal  and 

emergency  system 

Loss  of  steering  and  braking 

Inability  to  provide  arrested  landing  capability 

Based  on  these  safety  critical  failure  modes,  which 
have  been  identified  in  the  System  Safety  Assessments 
Reports , a list  of  safety  relevant  equipment  and 
components  have  been  established. 

It  should  be  noted  that  the  load  carrying  structure  is 
designed  according  safe  life  principles,  i.e.  a crack  free 
structure  during  operation  is  mandatory  as  no  structural 
redundancies  are  provided.  Therefore  these 
components  have  been  categorized  either  as  CAT1  or 
CAT2,  for  which  life  extension  will  be  assessed. 

Other  equipments  for  which  life  extension  is  carried 
out,  are  for  instance  amplifiers,  valves,  servo  valves, 
main  wheel  brake,  hydraulic  swivels,  foot  motors, 
actuators,  locks,  nitrogen  bottle,  anti-skid  generator, 
etc. 


Life  extension  philosophy 

The  basic  philosophy  of  life  extension  of  landing 
gear  system  components  is 

Review  of  original  qualification  test  results 

Theoretical  assessments  of  the  fatigue  life  using 
existing  or  in-service  OLM  measurements 

Extended  fatigue  tests  of  structural  components 

Extended  endurance  and  impulse  fatigue  testing  of 
mechanical  / hydraulic  components 

Investigation  of  high  aged  items  (sampling) 
regarding  their  physical  condition  after  4000  FH  in 
service  and  investigation  of  problem  areas 

Establishing  of  overhaul  and/or  revised  equipment 
maintenance  procedures  which  take  into  account 
aging  problems  as  experienced  during  sampling 
and  define  preventive  actions  for  further  safe  use 

Re-provisioning,  replacement  of  items  whose  life 
cannot  be  extended 

All  subsystem  components  which  are  critical  for 
the  retraction  & lowering  function  as  actuators,  locks, 
but  also  attachment  lugs  have  already  been  subject  to 
life  extension  activities  and  evidence  for  an  extended 
use  up  to  16000  FH  has  been  already  demonstrated. 

Landing  gear  structure 

Life  extension  of  structural  components  of  the 
landing  gear  and  its  back-up  structure  are  of  special 
concern,  as  it  is  known  that  the  operational  loading 
conditions  have  changed  during  the  lifetime  of  the 
aircraft,  for  instance  due  to  the  increased  aircraft 
masses,  which  are  operated  today. 

It  was  therefore  decided  some  years  ago  to  carry 
out  an  extensive  in-service  operational  load 
measurement  program  (OLM)  to  investigate  the 
operational  loading  conditions  on  the  landing  gear 
back-up  structure  and  the  legs  with  the  aim  to  review 
existing  clearances  and  establish  the  basis  for  future 
life  extension  activities. 

Two  sets  of  gears  were  strain  gauged  and 
installed  in  a GAF  and  RAF  aircraft  where  also  the 
attachment  and  back-up  structure  was  strain  gauged.  In 
total  more  than  325  flights  have  been  recorded  and 
assessment  of  the  measured  data  is  in  progress. 

As  these  aircraft  were  operated  in  different 
squadrons,  by  different  pilots,  with  different  masses 
and  different  store  conditions,  the  loading  information 
provides  a good  cross-section  of  the  operational  service 
loading  of  the  landing  gear  and  its  back-up  structure  in 
different  air  forces. 
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Initial  results  of  these  investigations  showed  that 
the  loads  are  partially  much  more  severe  than 
originally  anticipated. 

The  influence  of  these  in-service  loads  on  landing 
structure  clearances  is  a major  part  of  the  life  extension 
activities.  As  the  Tornado  Nose  Landing  Gear  (NLG) 
was  only  tested  up  to  the  original  life  requirement  of 
4000  FH,  it  was  decided  to  carry  out  a new  fatigue  test 
taking  into  account  the  in-service  loading  conditions, 
which  take  place  on  MAFT  (Major  Airframe  Fatigue 
Test  specimen). 

For  the  Main  Landing  Gear  structure,  a theoretical 
assessment  of  the  fatigue  clearance  has  started  and  later 
this  year,  when  this  assessment  will  have  been 
finalized,  a decision  on  the  way  forward  will  be  taken, 
whether  or  not  an  additional  fatigue  test  will  be 
required  in  order  to  provide  the  best  possible  clearance 
statement. 

Landing  Gear  Equipment 

Landing  gear  equipment  life  extension  base  on 
the  topics  already  described  above.  Equipment 
suppliers  have  defined  their  requirements  by  reviewing 
own  experiences  of  the  in-service  behavior  of  their 
equipment. 

Mostly  they  have  required  different  numbers  of 
high  aged  equipment  from  service  for  investigation  of 
wear  and  tear,  corrosion,  fatigue  cracks,  etc. 

Review  of  the  original  qualification  and  test 
results  and  the  results  of  the  sampling  investigations 
were  primarily  used  to  establish  whether  life  extension 
of  the  equipment  is  possible  or  not.  If  life  extension 
seemed  possible,  the  method,  which  the  supplier  has 
agreed  with  the  SDR  , is  applied. 

Aging  problems  on  equipments,  which  have  been 
identified  so  far  (wear  and  tear,  leakage),  will  be 
covered  by  required  overhaul  at  the  end  of  the  original 
design  life  of  4000  FH  before  further  use  up  to  8000 
FH  will  be  allowed.  The  required  overhaul  should  also 
identify  the  serviceability  of  that  equipment  as  being 
the  prerequisite  for  further  use. 

Aging  and  age  related  problems 

It  has  been  already  shown  in  the  chart  (Fig.  2) 
that  the  failure  rate  for  aging  related  failures  has 
increased  over  the  last  10  years  by  approximately  50%. 

Wear  and  tear  and  leaking  are  the  major  reported 
failures.  For  extended  use  it  is  necessary  that  the 
problem  areas  are  identified  and  addressed  by 
modifications,  inspections  and  maintenance. 

Beside  the  life  extension  program,  a very 
thorough  inspection  for  corrosion,  wear  and  tear  of 


high  aged  Main  and  Nose  Landing  Gears,  which  were 
in  service  for  more  than  15  years,  has  been  carried  out 

Corrosion  and  wear  has  been  found  in  some 
areas,  for  which  repairs  are  defined.  But  it  will  be  also 
important  to  address  these  areas  by  inspections  and  a 
revised  maintenance  policy. 

Two  areas  were  found  which  are  of  special 
concern  as  they  demonstrate  what  can  happen  if 
maintenance  procedures  are  inadequate  in  addressing 
aging  effects  in  time. 

These  areas  are  not  directly  inspectable  and 
would  require  partially  disassembly.  As  existing 
maintenance  procedures  do  not  require  disassembly  of 
the  gears  to  inspect  these  areas  it  could  happen  that  the 
gears  are  for  years  on  the  aircraft  or  in  stock  and  the 
condition  of  components  in  certain  areas,  which  are  not 
visible  inspectable,  are  not  known: 

1 . Severe  corrosion  has  been  found  on  the  outside  of 
the  tumable  MLG  shockabsorber,  Fig.  4,  which  is 
made  of  high  strength  steel  300M,  in  an  area, 
which  is  covered  by  the  Main  Fitting  and  belongs 
to  a closed  volume  where  moisture  could  stay  for  a 
long  period  of  time.  Outside  of  this  area  no 
corrosion  was  found  on  the  shockabsorber. 


Fig.  4:  Corrosion  of  MLG  Shockabsorber 

It  is  considered  that  corrosion  is  to  be  due  to 
localized  attacks  of  the  base  metal  as  a result  of 
prolonged  exposure  to  moisture.  It  is  assumed  that 
moisture  in  this  volume  is  a result  of  condensation 
when  descending  from  altitude.  The  effect  of 
corrosion  with  regard  to  stress  corrosion  and 
fatigue  has  been  reviewed  and  not  considered 
critical  providing  an  inspection  program  is 
introduced  and  the  component  repaired  in  time. 
This  is  important  as  due  to  the  brittleness  of  the 
material  300M,  any  crack  in  this  area  could  cause 
immediate  fracture. 

An  inspection  procedure  has  been  issued 
which  address  this  area  in  a timely  manner. 
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2.  Severe  corrosion  has  also  been  found  at  the  NLG 
Steering  Collar,  Fig.  5. 


Fig.  5 : Corrosion  found  at  the  NLG  Steering  Collar 

Access  to  this  area  requires  also  disassembly  of  the 
gear.  As  water  was  found  in  this  area,  it  is 
considered  that  the  sealing  becomes  insufficient 
with  time.  The  corrosion  became  so  big  that  the 
torque  moment  required  to  turn  the  slider  increases 
far  beyond  the  specified  values. 

Fortunately,  the  investigation  revealed,  that  repair 
is  possible,  if  the  repair  is  applied  in  time. 

Electronic  components 

All  electric  and  electronic  components  are 
sufficient  for  life  extension  with  the  exception  of  the 
Anti  Skid  Control  Box,  which  cannot  be  life  extended 
due  to  aging  problems  due  to  increasing  number  of 
failures  of  the  PCB  (printed  circuit  boards)  soldering 
joints.  A repair  is  not  possible  because  the  components 
and  the  board  is  dipped  in  plastic  coating.  The 
exchange  of  PCBs  is  not  cost  effective  because  the  box 
shelf  represents  only  marginal  value  of  the  total  box 
price. 

Additional  there  are  other  aspects  related  to  the 
in-service  history  and  built  standard  of  Landing  gear 
components. 

Unfortunately  it  has  been  experienced  that  the  in- 
service  documentation  for  landing  gear  components  are 
not  always  available.  This  is  considered  to  be  a very 
critical  situation  as  for  instance  landing  gear  structural 
components  are  of  safe  life  design  with  no  backup 
available.  The  ignorance  of  service  history  and 
consumed  life  creates  many  problems,  which  need  to 
be  addressed  urgently  otherwise  the  airworthiness  is 
difficult  to  control. 

In  case  no  history  can  be  established  any  more,  a 
risk  assessment  has  to  be  performed  for  each  gear  and 
replacement  of  items  before  reaching  its  final  life  could 


be  necessary.  This  situation  will  become  more  critical 
if  the  life  extension  activities  results  in  lower 
clearances  for  structural  components  than  original 
stated  due  to  different  in-service  loading  conditions. 

Fuel  Subsystem 

General 

The  major  function  of  the  fuel  system  is  to 
provide  engine  fuel  supply  under  all  normal  operational 
and  emergency  conditions. 

Two  major  safety  critical  system  failures  as  stated 
in  the  System  Safety  Assessments  Report  are 

Insufficient  engine  fuel  supply 
Fire  hazard  due  to  fuel  leakage 

Based  on  these  system  failures,  equipment  and 
components  have  been  identified  whose  failure  would 
lead  or  contribute  to  these  system  failures. 

Additional,  the  arrangement  of  the  fuel  system 
within  the  aircraft  fuselage  in  conjunction  with  the 
forced  ventilation  of  compartments  / ducts  during 
aircraft  operations  has  been  considered  for  the 
assessment  of  the  fuel  system  component  safety 
categorization.  Consideration  of  the  general 
arrangement  and  operational  aspects  has  revealed  that 
fuel  leakage  or  fuel  mist  can  be  carried  from  the 
leaking  component,  which  may  be  located  in  an  area 
without  fire  / explosion  hazard,  into  areas  with 
potential  ignition  sources. 

Life  extension  philosophy 

The  basic  philosophy  of  life  extension  of  fuel 
system  components  is 

Definition  of  inspection  and  overhaul  procedures 
for  safe  pipework  operation  beyond  4000  FH  up  to 
8000  FH.  This  will  be  supported  by 

• Master  inspections 

• Zonal  inspections 

Sampling  and  re-qualification  testing  for  fuel 
hoses 

Review  of  original  qualification  test  results  and 
compare  to  future  operational  usage  requirements 

Analysis 

Extended  qualification  by  endurance,  vibration  and 
pressure  cycling  tests 

Establishing  of  future  maintenance  policy  for 
equipments 

Following,  (preliminary)  results  from  the  life  extension 
work  will  be  presented. 
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Fuel  system  Pipework 

Fuel  pipework  is  of  special  concern  as  fuel 
leakage  due  to  a broken  or  leaking  pipe  or  leaking 
coupling  could  significantly  contribute  to  safety 
relevant  hazards.  The  customer  requirement  for  fuel 
system  pipework  was  that  PANAVIA  should  define 
inspection  / overhaul  procedures,  which  ensure  that  the 
safe  operation  of  the  pipework  is  ensured  up  to  8000 
FH. 

The  procedures  will  be  defined  by  analyzing  the 
findings  gained  during  Master  and  Zonal  Inspections, 
which  have  been  performed  on  two  high  aged  aircraft 
from  the  RAF  and  GAF  (fleet  leader)  during  aircraft 
depot  inspections  (DI). 

The  following  activities  have  been  part  of  the 
Master  Inspection: 

visual  inspection  of  all  fuel  system  pipework 
items,  associated  fuel  system  couplings  and 
support  / attachment  parts 

examination  of  critical  elements,  which  have  been 
defined  prior  to  the  Master  Inspection.  Special 
emphasis  was  given  to  surface  damages,  corrosion, 
connection  and  attachment  areas,  dimensional 
checks 

proof  pressure  test  of  each  critical  element 

X-Ray  examination  of  all  welded  and  brazed  joints 

Fluorescent  penetrate  tests  of  all  welds 

NDT  investigation  of  critical  items  which 
experience  more  than  200  °C  during  service  in 
order  to  detect  materials  alteration  due  to  the 
exposure  to  high  temperatures 

Examination  of  seals 

definition  of  inspection  areas  and  maintenance 
measures  which  should  be  considered  for  the  final 
pipework  inspection  / overhaul  procedure  to  be 
applied  on  all  aircraft  beyond  4000  FH 

Zonal  Inspections,  which  took  place  on  two  RAF 
and  two  GAF  fleet  leader  aircraft,  based  on  the 
findings  of  the  Master  Inspection.  They  should  confirm 
the  findings  of  the  Master  Inspection  and  provide 
additional  practical  evidence  for  definition  of  the  final 
pipework  Inspection  / Overhaul  procedure. 

Master  Inspections  have  revealed  that  there  were 
no  cracks  and  no  problems  with  welds.  The  only 
problem  related  to  aging  was  corrosion. 

The  results  of  these  investigations  can  be 
summarized: 

Corrosion  was  detected  on  35%  of  all  pipework 
items;  14%  of  these  items  were  classified  as 
"reusable"  and  21%  as  "to  be  scrapped' 


40%  of  all  pipework  items  inspected  in  the  ventral 
duct  area  have  shown  corrosion 

28%  of  all  pipework  items  inspected  in  the  spine 
area  have  shown  corrosion 

Fig.  6 shows  the  propagation  of  intercrystalline 
corrosion  in  the  fuel  pipe  structure  (Aluminum)  in  the 
marked  area. 


The  findings  during  the  master  inspection  require 
inspections  and  an  optimized  maintenance  policy. 
Fortunately,  the  degree  of  corrosion,  which  was  found 
on  pipes  and  couplings,  need  no  immediate 
replacements  due  to  an  imminent  safety  hazard  but 
those  pipes  which  have  been  classified  as  “to  be 
scrapped”  have  been  replaced. 


Fig.  6:  Corrosion  on  a fuel  pipe  and  Micrograph 
Examination  of  corrosion  mark 

Fuel  flexible  Hoses 

Flexible  hoses  using  Teflon  or  rubber  have  been 
defined  as  CAT  1 and  they  will  be  replaced  after  their 
certified  life  is  reached  (Teflon  hoses  after  4000  FH, 
rubber  hoses  after  6 years).  This  is  a preventive 
measure  to  prevent  any  problems  with  material  aging 
and  consequently  leakage. 
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For  fuel  flexible  metallic  hoses  the  supplier  was 
tasked  to  carry  out  sampling  and  qualification  testing. 

A sequence  of  different  testing  will  be  performed, 
which  comprises  of 

visual  inspection  and  dimensional  check 

proof  pressure  and  leakage  tests 

x-ray  and  fluorescent  penetrate  examination 

pressure  pulse  test 

vibration  test 

microscopic  examination 

The  results  of  these  tests  are  still  outstanding. 

Fuel  Valves 

During  the  Life  Extension  Program  those  valves 
were  considered 

where  high  stresses  are  caused  by  medium 
pressure  / hot  fuel  environment  etc. 

where  in-service  experience  had  identified  units  to 
be  safety  critical  and 

which  are  installed  in  areas  where  any  leakage  will 
cause  a fire  / explosion  hazard.  On-condition 
operation  of  these  valves  beyond  their  certified  life 
of  4000  Fh  could  cause  additional  safety  hazards 
(fire  / explosion),  since  the  failure  rate  which  has 
to  be  considered  for  these  valves  beyond  their 
certified  life  is  not  known. 

Each  valve  assembly  consists  of  the  valve  and  the 
actuator  assembly.  As  far  as  the  valve  assemblies  are 
concerned,  the  suitability  for  life  extension  is  related  to 
the  valves  only.  Methods  for  extending  the  life  of  the 
valves  beyond  4000  FH  will  be  defined  by  the  Supplier 
by  means  of  Master  Inspections  performed  with  sample 
units.  Part  of  this  Master  Inspection  are  the 

examination  of  all  parts  for  corrosion,  damage, 
wear  and  tear 

check  of  all  rubber  and  elastomeric  parts  for 
hardness  and  quality 

examination  of  all  critical  parts  with  non- 
destructive and  X-ray  methods  (where  applicable) 

Direct  comparison  of  the  condition  of  the 
individual  sample  units. 

In  the  event  that  the  approved  method  of 
achieving  the  required  8000  FH  Life  Extension  should 
entail  Life  Extension  Qualification  Testing,  then  this 
testing  in  general  will  comprise  endurance  and 
vibration  testing 

The  Supplier  has  declared  all  actuator  assemblies 
unsuitable  for  Life  Extension  due  to  their  suspected 


poor  in-service  MTBF  and  known  design  limitations. 
He  proposed  therefore  to  replace  these  actuator 
assemblies  with  superior  equipment.  These  consist  of  a 
permanent  magnet  motor,  which  negates  the  use  of  the 
clutch  assembly  currently  used  on  the  Tornado 
actuators  and  offers  improved  switching  characteristics 
with  self-cleaning  action.  The  new  actuator  will  also 
offer  better  reliability  than  the  existing  one,  consist  of  a 
hermetically  sealed  electrical  connector  and  provides 
better  EMC  performance. 

Fuel  subsystem  equipment 

Many  equipment  from  the  fuel  subsystem  are  part 
of  life  extension  activities  as  they  have  been  classified 
as  safety  relevant.  These  items  are  manly  different  type 
of  pumps,  flexible  sliding  joints,  thermal  diffuser,  etc. 

Current  results  of  the  life  extension  process  from 
sampling,  analysis  and  re-qualification  revealed  that 
most  of  these  equipment  could  be  life  extended.  The 
DDPs  will  state  the  revised  clearances  and  additional 
requirements  for  overhaul  in  some  cases. 

For  the  double-ended  boost  pump,  the  electrical 
harness,  which  is  a safety  critical  component  (high 
voltage  power  line  which  is  submerged  in  fuel),  shall 
be  replaced  after  its  original  design  life  limits  are 
reached. 

Life  extension  of  fuel  coolers  requires  surge 
pressure  measurements  to  establish  in-service  realistic 
conditions. 

Fuel  Tanks 

The  Tornado  fuel  tanks  consist  of  bladder  type 
cells  of  different  construction.  The  tanks  are  pot  part  of 
the  life  extension  program  as  PANAVIA  has  already 
recommended  to  maintain  the  tanks  in  accordance  with 
an  "on-condition"  lifing  policy  with  no  significant 
adverse  effect  on  the  flight  safety  of  the  aircraft, 
although  reliability  may  be  degraded. 

Electrical  Wiring 

General 

Electrical  wiring  is  used  all  over  the  aircraft  in  all 
flight  systems.  Cable  looms  are  distributed  in  and 
through  many  zones  of  the  aircraft,  where  different 
environmental  conditions  exist  as  for  instant  heat, 
moisture,  in  case  of  leakage  fuel,  hydraulic  oil,  but  also 
vibration,  acoustic,  etc.  All  these  environmental  effects 
need  to  be  assessed  for  life  extension  of  the  electrical 
wiring. 

The  general  design  philosophy  of  the  electrical 
system  is  as  for  other  flight  safety  critical  systems,  that 
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no  single  failure  does  cause  a hazardous  situation. 
Therefore  the  wiring  system  is  categorized  as  CAT3. 

However  wiring  degradation  with  time  is  a 
significant  problem  as  if  not  maintained  it  could  cause 
a hazardous  situation. 

Wiring  can  fail  in  two  ways: 

a)  as  an  open  circuit  conductor  and 

b)  with  a short  circuit  to  another  wire  or  frame 

Case  a)  is  not  considered  to  be  safety  critical  as 
flight  systems  are  of  fail-safe  design.  It  is  assumed  that 
any  functional  failure  within  a flight  system  caused  by 
the  wire  failure  will  be  found  by  functional  on  aircraft 
tests. 

Case  b)  is  the  much  more  significant  failure  as  a 
short  circuit  to  a metallic  component  or  another  wire 
can  produce  an  electrical  arc  which  in  turn  can  cause  a 
hazardous  arcing  condition. 

The  probability  of  this  failure  condition  is 
considered  to  be  quite  small,  as  a series  of  correct 
conditions  need  to  be  present  in  the  same  time.  But 
with  increasing  age  of  the  wiring  this  probability  will 
increase  and  thorough  inspections  need  to  be  placed  in 
order  to  slow  down  the  increase. 

Life  extension  philosophy 

It  has  been  evaluated  that  life  extension  of  wiring 
by  extended  qualification  activities  may  not  lead  to  a 
life  increase,  as  it  could  be  shown  that  the  consumed 
life  is  dependent  on  many  factors  which  accelerate  the 
aging  of  the  wire  insulation.  Such  factors  are  for 
instance  the  location,  contamination  by  aggressive 
fluids,  heat  but  also  maintenance  activities  by  which 
the  wire  looms  are  manipulated. 

Therefore,  the  definition  of  a most  cost-effective 
maintenance  policy  is  the  basic  strategy  for  Tornado 
wiring  life  extension. 

The  following  engineering  activities  are 
performed  and  methods  investigated: 

Assessment  of  the  suitability  of  the  RAF  WIDAS 
(Wire  Insulation  Deterioration  Analysis  System)  as 


Infrared  Thermography  (IRT)  for  detection  of  wire 
failures  or  high-risk  conditions  will  be 

investigated. 

Wire  extended  qualification  testing  in  conjunction 
with  the  supplier.  These  tests  consist  of  dry  and 
wet  arc  and  thermal  life  tests.  Tests  will  be 
conducted  by  an  independent  laboratory  and  tests 
results  send  to  the  wire  manufacturer  for 
assessment. 

Investigation  of  other  methods  including  high 
voltage  (HV)  testing. 

Review  of  other  existing  wiring  policies  within 
airlines,  wire  manufacturer,  etc. 

Electrical  wiring  survey 

An  investigation  of  the  wiring  condition  in  a large 
number  of  aircraft  (49)  has  been  performed  in  order  to 
assess  the  state  of  wiring  within  different  aircraft, 
which  are  operated  in  different  air  forces,  at  different 
environmental  conditions,  which  are  subject  to 
different  maintenance,  etc. 

It  has  been  established  that  wiring  deterioration  is 
dependent  mainly  on  the  four  topics: 

a)  Applied  maintenance  policy: 

• Better  quality  of  preventive  maintenance 
(removing  of  oil  leakage,  dirt,  ...)  results  in 
better  condition  of  the  wiring  system. 

• The  use  of  de-humidifiers  has  a significant, 
positive  influence  on  the  level  of  corrosion. 

b)  Operational  environment: 

• Aircraft  operating  under  coastal  or  wet 
climatic  conditions  have  shown  more 
electrical  and  general  corrosion. 

• As  the  aircraft  spend  only  2%  of  their  total  life 
flying,  the  conditions  of  the  hangars  are 
important  regarding  deterioration  effects: 
warm  and  dry  hangar  conditions  have  positive 
effects  compared  to  the  aircraft  standing 
outside. 


a sampling  tool  that  provides  for  a preventative 
maintenance  program  of  timely  wire  replacement. 

Zonal  analysis  (ZA),  identifying  the  risk  of  wiring 
failure  on  a zone  by  zone  basis  considering  the 
environment  and  other  components  installed  in  this 
zone.  The  main  objective  of  these  activities  is  to 
identify  risk  areas  that  would  allow  the  definition 
of  dedicated  maintenance  policies.  These  areas 
could  then  be  subject  to  further  investigation  by 
other  methods.  The  definition  of  risk  areas  would 
also  remove  the  need  of  further  investigation  of 
low  risk  areas  and  so  reduce  costs. 


• Long  duration  flights  at  high  altitude  in  dry  air 
lead  to  a better  state  of  the  wiring  system 
compared  to  for  instance  trainer  aircraft, 
which  perform  much  more  cycles  (take  off 
and  landing)  and  fly  in  lower  height  with 
much  higher  air  humidity 

c)  Materials  used  in  the  wiring  system 

• Embrittlement  and  dry-out  of  tie  wraps 
exacerbate  chafing  at  tie  wraps  position, 
especially  where  tie  wraps  have  been  applied 
too  tightly  when  fitted,  which  could  be  the 
result  of  unsuitable  tooling. 
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• Use  of  heavy  plastic  spiral  wrapping  as  a 
sleeving  on  flexible  looms  is  unsuitable  as 
encouraging  insulation  cracking  at  the  point 
where  the  flexible  part  leaves  the  main  loom. 

• Perished  rubber  sleeves  if  they  perish  allow 
the  wiring  loom  to  open  up,  which  could  lead 
to  increased  chafing  and  rubbing 

• Use  of  heat  shrink  material  is  not  suitable  as 
flexible  looms  become  hard  and  can  make 
wiring  looms  rigid. 

d)  Time  in  service: 

• It  has  been  established  that  contamination  of 
the  wiring  system  by  dirt  and  oil  can  be 
related  to  the  aircraft  age  but  is  also  dependent 
on  the  frequency  of  cleaning  activities 

The  findings  of  this  survey  will  be  used  to  establish 
recommendations  for  further  usage  of  the  wiring 
system  for  a limited  period  of  time. 


Replacement 

Mechanical,  hydraulic  components 

The  majority  of  safety  relevant  components  have 
equipment  DDPs,  which  define  operational  and  other 
life  limits. 

Life  extension  of  hydraulic  components  such  as 
actuators  will  be  based  on  sampling  of  high  aged 
equipment,  theoretical  assessment  of  possible  further 
life  potential,  re-qualification  programs  where  possible 
and  overhaul  at  defined  intervals. 

Life  extension  of  mechanical  components  as  for 
instance  linkages,  control  rods,  control  stick  rods, 
levers  and  rudder  pedal  mechanism  are  covered  by  the 
structure  statement  (chapter  2)  and  no  fatigue  life 
extension  activities  are  necessary. 

Flight  Control  Computers 


Flight  Control  System 


General 

The  flight  control  system  consists  of  various 
components,  as  for  instance  hydraulic  and  mechanical 
actuators,  ball-screw  actuators,  electrical  motors, 
computers,  wiring,  switches,  control  rods,  lever,  etc.. 
As  for  other  systems,  the  effect  of  failures  of  any  FCS 
component  on  flight  safety  hazards  has  been 
investigated  taking  into  account  the  system  hazards  as 
defined  in  the  safety  analysis  documents. 

The  major  problems,  which  have  been  identified 
for  many  components,  are  related  to  fatigue  and 
endurance.  Failures  due  to  wear  and  tear  are  the  most 
reported  service  failures  (Fig.  2). 

Life  extension  philosophy 

Although  the  FCS  consists  of  a variety  of 
different  components,  such  as  mechanical/hydraulic  as 
well  as  electric/electronic  components,  life  extension  of 
these  equipment  will  base  on  the  following  general 
work: 

Sampling  of  high  aged  ex-service  units 

Analysis  of  the  MTBF  data. 

Theoretical  analysis  of  life  potential 

Re-qualification  tests  (endurance,  fatigue) 

Investigation  of  aging  effects  on  materials 
and  components  by  sampling 

Establishing  of  overhaul,  maintenance 
procedures 


The  Flight  Control  Computers  are  designed  and 
constructed  according  to  MIL-Specs  and  safety 
requirements  and  consist  of  a triplex  multi-channel 
computing  system  in  two  computer  boxes  (Lateral  and 
Pitch),  Fig.  7 (CSAS  computer). 


Fig  7:  CSAS  computer 

The  technology  used  in  these  computers  is 
developed  in  the  seventies  and  is  therefore  no  longer 
state  of  the  art.  In-service  support  becomes  more 
difficult  the  longer  the  computers  will  stay  in  service. 

Within  the  life  extension  program  the  supplier 
have  investigated  various  computer,  which  have  been 
in  service  nearly  4000  FH.  The  general  result  of  the 
survey  is  that  only  partially  degradation  of  equipment 
was  found  which  could  be  directly  attributed  to  aging. 
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Some  problems  have  been  found  which  could  be 
regarded  to 

poor  standard  of  repair  and 

the  application  of  conformal  coating 

but  it  is  considered  that  these  findings  will  not  degrade 
the  functional  performance  and  also  reliability. 

Additional,  minor  damages  were  found,  which 
could  be  caused  by  mishandling  during  maintenance 
work.  It  is  therefore  proposed  to  review  the  current 
handling  practices  so  that  no  undesirable  mechanical  or 
electrical  failures  are  introduced,  which  could  have  an 
influence  on  the  performance. 

The  survey  of  aged  electronic  components  has 
revealed  additional  problem  areas  as  following 
described. 

Aging  problems  with  electronic  components 

Relays 

Relays  are  not  pure  electronic  components 
but  consist  of  many  mechanical  parts  like  springs, 
special  contacts,  coil  and  printed  circuits  and  all 
parts  are  subject  to  continuous  aging. 

Relays  are  designed  for  a certain  (high) 
number  of  operations  and  the  degradation  of  the 
contact  will  result  in  an  increase  of  contact 
resistance. 

The  relays  which  have  been  investigated  in- 
depth  were  found  in  a good  condition  and 
replacement  is  only  proposed  if  any  failure  is 
found  or  if  they  are  physically  damaged. 

Potentiometers 

Variable  resistors  include  mechanical  and 
“Pertinax”  parts  which  produce  an  electronic 
resistor  by  moving  a mechanical  part  on  the 
surface  of  a small  “Pertinax”  part. 

During  the  aging  process,  environmental 
conditions  and  load  could  have  an  adverse  effect 
on  the  performance  of  this  type  of  resistor,  which 
might  result  in  a negative  influence  on  the  Build- 
In-Test-Equipment  (BITE). 

Investigation  of  aged  potentiometers  has 
revealed  in  some  cases  a degradation  of  the  case 
seal  and  also  the  existence  of  hairline  cracks, 
which  would  under  certain  conditions  allow  the 
ingress  of  moisture. 

It  is  therefore  proposed  to  investigate  the 
general  mechanical  and  functional  condition  of 
these  components  and  replacement,  if  the 
component  is  defined  as  unserviceable. 


Capacitors 

Capacitors  of  different  style  are  used. 

Aging  problems  have  been  experienced  for 
instance  with  'castanet'  wet  tantalum  capacitors. 
The  major  findings  are 

change  in  state  of  the  liquid  electrolyte,  in 
which  gas  bubbles  have  been  found 

loss  of  the  electrolyte  which  results  in 
corrosion  around  the  anode/cathode  seal, 
which  results  in  a reduction  of  the  capacitance 
value  (pF). 

Printed  Circuit  Boards  (PCB) 

PCBs  in  old  computers  are  partly  wired. 
Furthermore,  they  carry  connectors  for  the  Dual 
Card  Assemblies. 

Problems  have  been  experienced  with 
surface  leakage  currents,  which  could  be  a 
dormant  failure,  contamination  and  condensates  in 
conjunction  with  humidity. 

Also  local  delamination  of  the  top  layer  of 
the  PCB  was  found  in  areas  where  solder  pads 
have  been  repaired  and  probably  excessive  heat 
were  introduced.  It  is  therefore  considered  that  the 
delamination  is  attributed  to  poor  standard  in- 
service  rework. 

Additionally,  aging  of  the  PCB's  solder 
joints  have  been  found,  as  shown  in  Fig.  8. 

Connectors 

Similar  problem  as  described  for  the  PCBs 
have  been  experienced  with  connectors,  which 
have  connections  to  the  PCBs  and  to  the  wiring  via 
solder  joints. 

Wiring  (within  Computers) 

The  major  problems  with  wiring  within  the 
computers  are  cable  chafing  with  nuisance  effects. 

Resistors 

It  has  been  experienced  that  aging  could 
change  the  tolerance  of  resistors.  Therefore  the 
logic  circuit  which  the  related  resistor  belongs  to 
will  change  and  this  can  produce  failures  and  No- 
Go's  during  BITE. 

Transistors,  Integrated  Circuits  (ICs),  OP- 
amplifiers 

Load-Life  during  different  usage  of  the 
aircraft  and  maintenance  may  stress  these 
electronic  components. 
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Fig.  8:  Aged  solder  joints  of  PCB's 

Influences  of  operational  Environment 

The  Tornado  aircraft  is  operated  by  different 
airforces  in  different  environmental  conditions.  The 
Tornado  is  also  used  as  a Navy  variant.  Therefore  very 
different  operational  conditions  exist,  which  have  a 
different  influence  on  aging. 

The  following  should  describe  briefly  the  major 
environments  which  contribute  to  aging  of  electronic 
components  of  the  Flight  Control  Computers  and 
which  influence  is  assessed  during  the  life  extension 
work: 

BITE-Runs  (Preflight/First  Line) 

High  altitude  flights 

Power  ON/OFF  cycles 


Different  Weather  conditions  such  as  high/low 
temperature,  high  humidity,  lightening,  salty 
atmosphere 

An  example  for  corrosion  due  to  environmental 
influences  is  the  corrosion  around  power  resistor  leads 
found  due  to  Doghouse  - environmental  influence,  Fig. 
9. 


Fig.  9:  Corrosion  around  power  resistor  leads 

Additional,  the  following  influences  could  have  a 
degrading  effect  on  component  integrity 

Operation  in  Navy  / Air  Force 

The  Tornado  is  designed  for  different  combat 
roles.  The  equipment,  which  is  operated  within 
Navy  aircraft,  is  exposed  to  salty  atmosphere  and 
therefore  the  effect  of  corrosion  becomes  more 
critical  for  these  types  of  aircraft  as  they  are  often 
flying  over  ocean. 

Wars 

Wars  like  the  past  Gulf  and  Bosnia  will  have 
special  influence  as  normal  flying  in  squadrons 
from  home  base.  Heavy  stores  and  more  agile 
flying  will  stress  not  only  the  airframe  but  also  the 
electronic  equipment  (cards,  boxes,  wiring, 
connectors). 

Parking 

Normal  Parking  of  A/C  in  a shelter  with  covers  on 
all  potential  sensors  like  the  ADD-Probe  is  needed 
for  a long  life.  Parking  on  and  outside  airfield  and 
sensors  not  covered  is  a potential  hazard  for  fast 
aging  of  electronic  equipment  and  their  sensoric 
system. 

Storage 

Storage  of  electronic  equipment  is  not  the  same  as 
for  mechanical  parts.  The  electronic  items  will  age 
under  these  conditions  as  well  as  under  normal 
usage. 
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To  investigate  the  life  consumption  of  electronic  parts, 
the  correct  service  history  need  to  be  assessed. 
Therefore  it  is  essential  that  configuration  control  is 
possible  for  all  critical  equipment  and  components. 

Life  extension  of  FC  computer  by  overhaul 

As  for  other  equipment,  the  supplier  will  give  a 
guarantee  for  his  equipment  only  for  usage  within  the 
specified  operational  and  life  limits. 

Extended  qualification  of  the  Flight  Control 
Computers  was  discussed  to  fulfill  the  customer 
requirements  for  life  extension.  But  due  to  the  high 
costs  of  this  re-qualification  process  a different 
approach  was  examined  with  the  supplier  customer. 

It  was  decided  that  life  extension  of  the  FC 
computer  will  base  on  overhaul  after  the  equipment  has 
reached  its  certified  service  life. 

The  procedure  base  on  knowledge  of  the  supplier 
maintenance  work  and  by  sampling  of  high  aged 
service  equipment: 

Survey  of  early  manufactured  computers  to 
identify  time  dependent  effects,  which  will  be  used 
to  produce  test  and  inspection  procedures 
Research  failure  and  repair  records  required  from 
service 

In  depth  investigations  of 

- PCBs 

Connections 

Active  components  (i.e  transistors) 

Passive  Components  (i.e  capacitors) 

Case  structure 

These  investigations  will  be  used  to  establish 
overhaul  procedures  for  the  different  type  of 
computers.  These  procedures  are  currently  under  strong 
discussion  with  the  customer  and  the  suppliers  and  the 
following  general  measures  are  foreseen: 

Detail  examination  of  the  physical  condition, 
identifying  of  aging  problems  and  components 
which  need  to  be  replaced 
functional  check 
cleaning 

EMC  Test:  Early  standards  of  the  Flight  Control 
Computers  are  EMI  hardened.  Therefore  an  EMC 
test  will  be  conducted  after  the  overhaul  procedure 
has  been  successfully  performed. 

Conducting  of  an  Automatic  Test  Procedure  (ATP) 
Release  to  service 

Obsolescence  of  electronic  components 

Review  of  the  availability  of  electronic 
components  for  the  FCS  computer  revealed  that  the 
obsolescence  problem  becomes  more  and  more  critical. 


To  overcome  this  situation  the  following  options  are  in 
discussion: 

a)  Lifetime  buy  of  components,  which  will  be  no 
more  available  in  the  future.  Presently  up  to  50 
electronic  components  are  no  more  available  on 
the  market.  This  concerns  especially  FET 
switches.  Power  Transistors,  PROMs,  Optic 
couplers,  special  AT)  converter,  TTL  components. 
Resistor  - Thickfilm  networks,  etc. 

b)  Redesign  using  actual  standards  of  components 
and  modem  production  processes  to  achieve 
compatible  equipments  on  LRU  level. 

c)  Development  of  new  concepts,  new  technology 
with  new  hardware  as  well  as  software,  together 
with  limited  measures  related  to  alternatives  a)  and 
b)  for  the  interim  period  of  years  until  completion 
of  introduction  in  service. 

Presently  the  way  forward  is  not  yet  decided  and  will 
base  on  the  experience  and  requirements  established 
within  the  life  extension  program 

Hydraulic  System 

General 

Safety  relevant  hydraulic  subsystem  equipment 
and  components  have  been  identified  based  on 
assessment  of  the  System  Safety  Assessments  Report. 

The  major  subsystem  failures  modes  are 

Loss  of  hydraulic  power  and  hydraulic  flow  which 
would  lead  to  loss  of  aircraft  control 

Loss  of  emergency  equipment  function  required  in 
the  event  of  an  emergency 

The  evaluation  of  age  related  system  failures,  Fig.  2, 
have  shown  that  leakage  is  the  most  significant 
reported  in-service  occurrence,  which  is  well 
understood,  as  endurance  of  hydraulically  functional 
equipment  will  lead  over  time  to  a degradation  of  the 
seals.  This  means  that  the  older  the  equipment  stays  in 
service  the  often  unscheduled  maintenance  will  be 
required  to  address  these  problems. 

Life  extension  philosophy 

The  life  extension  philosophy  for  the  hydraulic 
subsystem  equipment  and  components  base  mainly  on 
sampling  and  re-qualification  of  equipment  and  the 
definition  of  maintenance  and  overhaul  requirements. 

A Master  Inspection  for  investigation  of  the 
condition  of  hydraulic  subsystem  components  in  aged 
aircraft  is  currently  not  performed. 
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Hydraulic  Subsystem  equipment 

Many  equipment  and  components  have  been 
selected  for  life  extension  as  for  instance  pumps, 
pressure  switches,  accumulator,  valves,  self  sealing 
couplings,  reservoir,  slide  and  swivel  joints,  etc. 

Aged  equipment  from  service  have  been 
delivered  to  the  suppliers  for  detail  investigation  of  the 
condition  after  4000  FH  in  service  and  to  state  the 
serviceability  for  further  usage. 

Most  of  the  hydraulic  equipment  will  be  re- 
qualified by  extended  impulse-fatigue  tests,  endurance 
and  fatigue  tests. 

Current  results  indicate  that  most  of  the 
equipment,  which  are  subject  to  life  extension,  will  be 
suitable  for  8000  FH.  An  overhaul  after  4000  FH  will 
probably  be  required  by  the  supplier  after  the  original 
specified  life  is  reached. 

During  this  overhaul  the  units  will  be  resealed 
and  areas,  which  have  shown  wear  and  tear  needs  to  be 
repaired,  if  necessary. 

Aging  of  equipment  (corrosion,  wear  and  tear)  as 
well  as  contamination  of  e.g.  filters  need  to  be 
addressed  by  appropriate  in-service  maintenance 
procedures. 

Hydraulic  piping 

Fatigue  life  of  hydraulic  pipes  is  not  of  concern. 
Therefore  no  activities  for  life  extension  are  foreseen. 

Aging  effects,  as  corrosion  of  the  high-pressure 
steel  pipes  need  to  be  addressed  by  appropriate 
maintenance  activities.  Nevertheless,  leakage  is  not 
considered  as  safety  critical  and  severe  leakage  will  be 
detected  early  by  pre-flight  or  post  flight  checks. 

Hydraulic  hoses 

Life  extension  of  hydraulic  hoses  is  in  discussion 
and  there  will  be  different  solutions  for  high  and  low 
pressure  hoses.  It  is  likely  that  high-pressure  hoses 
need  to  be  replaced  after  normal  service  life. 

Significant  aging  effects  on  high  aged  hoses  have 
not  been  experienced. 

Environment  Control  System 

General 

The  ECS  subsystem  consists  of  a number  of  sub- 
subsystems as  for  instance  cabin  pressurization,  engine 
anti-icing  system,  temperature  control  system, 
windscreen  heating  system,  etc. 


Again,  based  on  the  original  System  Safety 
Assessments,  safety  relevant  equipment  have  been 
identified  and  the  customer  has  defined  equipment  for 
which  life  extension  should  be  carried  out. 

Mainly  all  equipment  and  components,  which 
belongs  to  the  high  pressure  and  high  temperature  part 
of  the  ECS  system  and  subject  to  engine  bleed  air 
conditions  are  critical. 

The  components  which  belongs  to  the  low 
pressure  ECS  part  are  categorized  as  non  safety 
relevant.  No  specific  life  extension  measure  are 
foreseen  and  also  no  investigations  into  aging  problems 
are  performed. 

Life  extension  philosophy 

Life  extension  measures  for  ECS  equipment  and 
components  are  basically: 

Sampling  of  aged  equipment 

Stress,  fatigue  analysis 

Definition  and  conduction  of  re-qualification  tests 

Master  inspection  for  critical  zones  of  intercooler 
ejector  line 

Definition  of  maintenance  procedures 

ECS  Subsystem  equipment 

Equipment,  which  is  subject  to  life  extension 
activities,  are  for  instance  valves,  pre-cooler,  reservoir 
bottle. 

These  items  are  subject  to  life  extension  measures 
as  defined  before.  The  investigation  of  aging  effects  on 
equipment  is  performed  during  sampling  of  high  aged 
components. 

ECS  ducting  system 

A Master  Inspection  is  proposed,  which  should 
investigate  the  critical  zone  of  the  intercooler  ejector 
line. 

The  main  objectives  of  the  Master  Inspection  are 

Investigation  of  installation  aspects  to  support  of 
life  extension  of  ducts  and  critical  bellows 
including  investigation  of  bellows  inner  condition 
to  enable  decision  for  re-qualification  testing  of 
bellows  / structural  interface 

Investigation  of  the  physical  condition  related  to 
aging  aspects,  mainly  external  corrosion  beneath 
the  insulation 

The  investigations  have  not  yet  started. 
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Part  4 

Conclusion 

The  Tornado  life  extension  program  was  defined 
to  extend  the  life  of  the  aircraft  up  to  8000  FH.  Within 
this  program,  which  is  still  in  progress,  a clear  process 
has  been  defined  for  subsystem  life  extension,  which 
focuses  mainly  on  safety  relevant  equipment  and 
components. 

Part  of  this  process  are  investigations  into  the 
aging  condition  of  equipment  and  components,  which 
are  near  to  the  end  of  their  certified  life.  The  results  of 
these  investigations,  mainly  got  by  sampling  of  aged 
equipment,  Master  and  Zonal  Inspections,  are  used  to 
support  the  definition  of  requirements  for  further 
extended  use  of  equipment  beyond  their  certified  life. 

Aging  problems,  such  as  corrosion,  wear  and  tear, 
leakage,  or  degradation  of  electronic  components,  etc. 
have  been  identified  in  many  subsystems  but 
fortunately  none  of  them  required  immediate  action  to 
prevent  a safety  critical  hazard.  Aging  problems  will  be 
addressed  by  overhaul,  repair  or  replacement  actions, 
dependent  on  the  condition  of  the  item  investigated,  but 
also  on  factors  like  economics,  spares  availability  and 
overall  fleet  management. 

Experiences  we  made  during  the  time  carrying 
out  the  life  extension  program: 

Supplier  are  mostly  unaware  of  the  in-service 
experience  with  their  equipment 

Strong  and  time  consuming  discussions  were 
necessary  between  customer,  SDR  and  supplier  to 
define  a by  all  involved  parties  agreed  approach 
for  life  extension  for  certain  equipment 

Service  history  and  life  consumption  cannot  be 
provided  for  many  equipment,  which  means  that 
the  point  where  the  equipment  should  be  subject  to 
agreed  life  extension  measures  (i.e.  overhaul, 
replacement  of  the  complete  unit  or  detail  parts)  is 
difficult  or  even  not  possible.  Recording 
equipment  life  woulf  help  minimising  operating 
costs  as  the  full  performance  of  the  equipment  can 
be  used. 

Non  availability  of  service  documentation  resulted 
in  the  fact  that  provision  of  suitable  loan 
equipment  for  investigation  at  the  supplier  was 
difficult  to  locate. 

The  effort  unertaken  to  re-qualify  equipment 
beyond  dieir  original  certified  life  is  often 
significant.  Since  in  the  Tornado  program  most 
equipment  have  in  nthe  past  only  been  quaified  up 
to  their  original  specification  requirements  it 
should  be  considered  much  more  cost  effective,  if 


the  equipment  would  have  been  tested  to  failure 
ideally  just  after  normal  qualification  to  spec  has 
been  completed. 

As  general  conclusion  it  can  be  stated  that  life 
extension  of  Tornado  subsystems  is  successful  as  in 
many  cases  the  customer  requirements  can  be  met. 

PANAVIA  and  their  supplier  have  or  will  clearly 
specify  overhaul,  inspection  and  maintenance 
requirements  for  equipments  which  failure  would  be 
hazardous  and  which  should  be  mandatory  for  further 
safe  operation.  Aging  aspects  will  be  covered  by  these 
inspection  requirements. 


References: 

1.  PDT  1299:  TORNADO  Life  Extension  Process 
Definition  Document 

2.  PDT  1299  Phase  A Report 

3.  Various  reports  and  presentations  of  inspection 
results 
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PDT  1299:  Life  Extension  Phase  A/B 


Life  Extension  Phase  C & D for  Flight  Systems  &Equipment 

(Items  shown  in  bold  letters  indicate  customer  / operator  dependency) 
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Process  for  identification  of  Life  limited,  Safety  Relevant  PANAVIA 

Standards 


(except  where  inspection  is  required) 


